I reverse-engineered my cheap Android projector and found a known malware loader with command-and-control capabilities.

To be fair, “reverse engineering” sounds more impressive than it was, I didn't even have to use Reverse-Engineer-Anything. The device shipped with a public development signing key and a security system set to warn rather than enforce. It wasn't exactly trying to keep me out.

I bought this cheap project last year for some casual watching and because of the Darknet Diaries episode about Badbox. After keeping it isolated and never connected to the internet, eventually my curiosity won, so I put it on isolated and tightly monitored Wi-Fi and started analyzing its behavior:

Within minutes it silently installed apps, shipped a dormant piece of known malware with C2 and began sending ads, telemetry and my device's fingerprint to Chinese servers in plain HTTP.